CVE-2026-9136

creationtimestamp| type| source ---|---|--- 2026-05-20 20:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcs744lqz2p...

CVE-2026-9136 Unauthorized ShadowAttribute modification in MISP via client-supplied identifier

A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlled ShadowAttribute request data without removing the id field before saving the record. Because the underlying framework treats a supplied primary key as an instruction to update...